--- title: Lessons from Log4Shell: Building a CRA-Ready Log4j description: The VP of Logging at the Apache Software Foundation recounts how the Log4Shell vulnerability (CVE-2021-44228) forced a comprehensive overhaul of the Log4j... canonical: https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Lessons from Log4Shell: Building a CRA-Ready Log4j | daily.dev og:description: The VP of Logging at the Apache Software Foundation recounts how the Log4Shell vulnerability (CVE-2021-44228) forced a comprehensive overhaul of the Log4j... og:url: https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux og:image: https://api.daily.dev/og/posts/Ji7ZXoGUx.png og:image:alt: Lessons from Log4Shell: Building a CRA-Ready Log4j og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Lessons from Log4Shell: Building a CRA-Ready Log4j **[The Apache Software Foundation Blog](https://daily.dev/sources/apache)** · 8 min read · 4 upvotes · 0 comments ## Summary The VP of Logging at the Apache Software Foundation recounts how the Log4Shell vulnerability (CVE-2021-44228) forced a comprehensive overhaul of the Log4j project, and how that work aligns with the EU Cyber Resilience Act (CRA). Key improvements include: rewriting documentation to surface security best practices and an explicit security model; migrating from manual builds to reproducible GitHub Actions CI with SLSA attestations; publishing CycloneDX SBOMs and developing automated VEX statements; establishing a structured vulnerability handling process including a bug bounty program; and modularizing Log4j 3 to reduce attack surface. The post also addresses the unsolved problem of maintainer sustainability, with only two active maintainers currently, and outlines community and funding initiatives to address it. The core message is that CRA compliance and a healthier open source project are the same goal. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Inside the breach that broke the internet: The untold story of Log4Shell](https://daily.dev/posts/inside-the-breach-that-broke-the-internet-the-untold-story-of-log4shell-ix6k9dw9u) · GitHub Blog · 1 upvotes · 0 comments - [CRA readiness starts in the codebase](https://daily.dev/posts/cra-readiness-starts-in-the-codebase-241zchdhk) · The New Stack · 1 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#open-source](https://daily.dev/tags/open-source), [#sbom](https://daily.dev/tags/sbom), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Lessons from Log4Shell: Building a CRA-Ready Log4j","url":"https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux"},"datePublished":"2026-04-21T15:36:18.399Z","dateModified":"2026-10-15T02:22:26.417Z","description":"The VP of Logging at the Apache Software Foundation recounts how the Log4Shell vulnerability (CVE-2021-44228) forced a comprehensive overhaul of the Log4j...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"The Apache Software Foundation Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Apache Software Foundation Blog","logo":"https://media.daily.dev/image/upload/s--SQsDxMlv--/f_auto/v1721999281/logos/apache","url":"https://daily.dev/sources/apache"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/lessons-from-log4shell-building-a-cra-ready-log4j-ji7zxogux","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"java,open-source,sbom,security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Apache Software Foundation Blog","item":"https://daily.dev/sources/apache"},{"@type":"ListItem","position":3,"name":"Lessons from Log4Shell: Building a CRA-Ready Log4j"}]} ```